@bitkyc08/opencodex 2.12.0 → 2.13.0

package/src/oauth/account-import/google-antigravity-adapter.ts

@@ -0,0 +1,74 @@
+import { validateAntigravityImportCredential } from "../google-antigravity";
+import { upsertCredentialByIdentity } from "../store";
+import type { OAuthCredentials } from "../types";
+import {
+  ACCOUNT_IMPORT_FORMAT,
+  ACCOUNT_IMPORT_MAX_EMAIL_LENGTH,
+  ACCOUNT_IMPORT_PROVIDER,
+  throwIfAccountImportAborted,
+  type AccountImportAdapter,
+  type CockpitAccountRecord,
+  type ValidatedAntigravityCredential,
+} from "./types";
+
+export interface AntigravityImportAdapterDeps {
+  validate(refreshToken: string, signal?: AbortSignal): Promise<ValidatedAntigravityCredential>;
+  upsert(credential: OAuthCredentials): Promise<"inserted" | "updated">;
+}
+
+function safeProviderEmail(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const normalized = value.toLowerCase();
+  if (
+    normalized.length === 0
+    || normalized.length > ACCOUNT_IMPORT_MAX_EMAIL_LENGTH
+    || normalized !== normalized.trim()
+    || /[\x00-\x20\x7f]/.test(normalized)
+  ) return null;
+  return normalized;
+}
+
+export function createAntigravityAccountImportAdapter(
+  deps: AntigravityImportAdapterDeps = {
+    validate: validateAntigravityImportCredential,
+    upsert: credential => upsertCredentialByIdentity(ACCOUNT_IMPORT_PROVIDER, credential),
+  },
+): AccountImportAdapter {
+  return {
+    provider: ACCOUNT_IMPORT_PROVIDER,
+    format: ACCOUNT_IMPORT_FORMAT,
+    async importRecord(record: CockpitAccountRecord, signal?: AbortSignal) {
+      throwIfAccountImportAborted(signal);
+      let credential: ValidatedAntigravityCredential;
+      try {
+        credential = await deps.validate(record.refreshToken, signal);
+      } catch {
+        throwIfAccountImportAborted(signal);
+        return { status: "failed", code: "credential_rejected" };
+      }
+
+      throwIfAccountImportAborted(signal);
+
+      const providerEmail = safeProviderEmail(credential.email);
+      if (!providerEmail) return { status: "failed", code: "credential_rejected" };
+      if (providerEmail !== record.email) return { status: "failed", code: "identity_mismatch" };
+      if (typeof credential.projectId !== "string" || credential.projectId.length === 0) {
+        return { status: "failed", code: "missing_project" };
+      }
+
+      throwIfAccountImportAborted(signal);
+      try {
+        const disposition = await deps.upsert({
+          ...credential,
+          email: providerEmail,
+          source: "credential-file",
+        });
+        return disposition === "updated"
+          ? { status: "updated", code: "updated" }
+          : { status: "imported", code: "imported" };
+      } catch {
+        return { status: "failed", code: "persist_failed" };
+      }
+    },
+  };
+}

package/src/oauth/account-import/index.ts

@@ -0,0 +1,15 @@
+export { importAccounts } from "./service";
+export {
+  ACCOUNT_IMPORT_DEADLINE_MS,
+  ACCOUNT_IMPORT_FORMAT,
+  ACCOUNT_IMPORT_MAX_BYTES,
+  ACCOUNT_IMPORT_MAX_REQUEST_BYTES,
+  ACCOUNT_IMPORT_PROVIDER,
+} from "./types";
+export type {
+  AccountImportCode,
+  AccountImportRecordResult,
+  AccountImportRequest,
+  AccountImportResult,
+  AccountImportStatus,
+} from "./types";

package/src/oauth/account-import/parser.ts

@@ -0,0 +1,83 @@
+import {
+  ACCOUNT_IMPORT_MAX_BYTES,
+  ACCOUNT_IMPORT_MAX_EMAIL_LENGTH,
+  ACCOUNT_IMPORT_MAX_RECORDS,
+  ACCOUNT_IMPORT_MAX_REFRESH_TOKEN_BYTES,
+  type ParsedCockpitRecord,
+} from "./types";
+
+const encoder = new TextEncoder();
+const ALLOWED_RECORD_KEYS = new Set(["email", "refresh_token", "tags", "notes"]);
+
+export type CockpitDocumentParseResult =
+  | { ok: true; records: ParsedCockpitRecord[] }
+  | { ok: false; code: "invalid_document" };
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function serializedDocumentSize(document: unknown): number | null {
+  try {
+    const serialized = JSON.stringify(document);
+    return serialized === undefined ? null : encoder.encode(serialized).byteLength;
+  } catch {
+    return null;
+  }
+}
+
+function validEmail(value: unknown): value is string {
+  if (typeof value !== "string" || value.length === 0 || value.length > ACCOUNT_IMPORT_MAX_EMAIL_LENGTH) return false;
+  if (value !== value.trim() || /[\x00-\x20\x7f]/.test(value)) return false;
+  const at = value.indexOf("@");
+  return at > 0 && at === value.lastIndexOf("@") && at < value.length - 1;
+}
+
+function validRefreshToken(value: unknown): value is string {
+  return typeof value === "string"
+    && value.length > 0
+    && encoder.encode(value).byteLength <= ACCOUNT_IMPORT_MAX_REFRESH_TOKEN_BYTES
+    && !/[\s\x7f]/.test(value);
+}
+
+function validMetadata(record: Record<string, unknown>): boolean {
+  if (record.tags !== undefined && (
+    !Array.isArray(record.tags)
+    || record.tags.some(tag => typeof tag !== "string")
+  )) return false;
+  return record.notes === undefined || typeof record.notes === "string";
+}
+
+function parseRecord(value: unknown, index: number): ParsedCockpitRecord {
+  if (!isPlainRecord(value)) return { index, code: "invalid_record" };
+  if (Object.keys(value).some(key => !ALLOWED_RECORD_KEYS.has(key))) return { index, code: "invalid_record" };
+  if (!validEmail(value.email) || !validRefreshToken(value.refresh_token) || !validMetadata(value)) {
+    return { index, code: "invalid_record" };
+  }
+  return {
+    index,
+    record: {
+      email: value.email.toLowerCase(),
+      refreshToken: value.refresh_token,
+    },
+  };
+}
+
+export function parseCockpitAccountDocument(document: unknown): CockpitDocumentParseResult {
+  const size = serializedDocumentSize(document);
+  if (size === null || size > ACCOUNT_IMPORT_MAX_BYTES) return { ok: false, code: "invalid_document" };
+  if (!Array.isArray(document) || document.length === 0 || document.length > ACCOUNT_IMPORT_MAX_RECORDS) {
+    return { ok: false, code: "invalid_document" };
+  }
+  const seen = new Set<string>();
+  const records = document.map((value, index): ParsedCockpitRecord => {
+    const parsed = parseRecord(value, index);
+    if ("code" in parsed) return parsed;
+    if (seen.has(parsed.record.email)) return { index, code: "invalid_record" };
+    seen.add(parsed.record.email);
+    return parsed;
+  });
+  return { ok: true, records };
+}

package/src/oauth/account-import/registry.ts

@@ -0,0 +1,18 @@
+import { createAntigravityAccountImportAdapter } from "./google-antigravity-adapter";
+import {
+  ACCOUNT_IMPORT_FORMAT,
+  ACCOUNT_IMPORT_PROVIDER,
+  type AccountImportAdapter,
+} from "./types";
+
+export type AccountImportRegistryResult =
+  | { ok: true; adapter: AccountImportAdapter }
+  | { ok: false; code: "unsupported_provider" | "unsupported_format" };
+
+const antigravityAdapter = createAntigravityAccountImportAdapter();
+
+export function resolveAccountImportAdapter(provider: string, format: string): AccountImportRegistryResult {
+  if (provider !== ACCOUNT_IMPORT_PROVIDER) return { ok: false, code: "unsupported_provider" };
+  if (format !== ACCOUNT_IMPORT_FORMAT) return { ok: false, code: "unsupported_format" };
+  return { ok: true, adapter: antigravityAdapter };
+}

package/src/oauth/account-import/service.ts

@@ -0,0 +1,75 @@
+import { parseCockpitAccountDocument } from "./parser";
+import { resolveAccountImportAdapter, type AccountImportRegistryResult } from "./registry";
+import {
+  AccountImportAbortError,
+  throwIfAccountImportAborted,
+} from "./types";
+import type {
+  AccountImportRequest,
+  AccountImportResult,
+  AccountImportRecordResult,
+} from "./types";
+
+export type AccountImportServiceResult =
+  | { ok: true; result: AccountImportResult }
+  | {
+    ok: false;
+    status: 400 | 408;
+    code: "unsupported_provider" | "unsupported_format" | "invalid_document" | "import_cancelled";
+    /** True when at least one credential was committed before the terminal failure. */
+    changed?: boolean;
+  };
+
+export interface AccountImportServiceDeps {
+  resolveAdapter(provider: string, format: string): AccountImportRegistryResult;
+}
+
+export async function importAccounts(
+  request: AccountImportRequest,
+  deps: AccountImportServiceDeps = { resolveAdapter: resolveAccountImportAdapter },
+): Promise<AccountImportServiceResult> {
+  // Provider/format admission intentionally precedes any traversal or serialization of the
+  // credential-bearing document.
+  const resolved = deps.resolveAdapter(request.provider, request.format);
+  if (!resolved.ok) return { ok: false, status: 400, code: resolved.code };
+
+  const parsed = parseCockpitAccountDocument(request.document);
+  if (!parsed.ok) return { ok: false, status: 400, code: parsed.code };
+
+  const results: AccountImportRecordResult[] = [];
+  try {
+    for (const item of parsed.records) {
+      throwIfAccountImportAborted(request.signal);
+      if ("code" in item) {
+        results.push({ index: item.index, status: "failed", code: item.code });
+        continue;
+      }
+      const outcome = await resolved.adapter.importRecord(item.record, request.signal);
+      results.push({ index: item.index, ...outcome });
+      // Record the committed outcome before observing cancellation. The route uses this
+      // internal signal to reconcile live stores and caches even when the public response
+      // is the terminal 408 DTO.
+      throwIfAccountImportAborted(request.signal);
+    }
+  } catch (error) {
+    if (error instanceof AccountImportAbortError) {
+      const changed = results.some(result => result.status === "imported" || result.status === "updated");
+      return { ok: false, status: 408, code: "import_cancelled", ...(changed ? { changed: true } : {}) };
+    }
+    throw error;
+  }
+
+  const count = (status: AccountImportRecordResult["status"]) =>
+    results.filter(result => result.status === status).length;
+  return {
+    ok: true,
+    result: {
+      totalCount: results.length,
+      importedCount: count("imported"),
+      updatedCount: count("updated"),
+      failedCount: count("failed"),
+      unsupportedCount: count("unsupported"),
+      results,
+    },
+  };
+}

package/src/oauth/account-import/types.ts

@@ -0,0 +1,91 @@
+import type { OAuthCredentials } from "../types";
+
+export const ACCOUNT_IMPORT_PROVIDER = "google-antigravity" as const;
+export const ACCOUNT_IMPORT_FORMAT = "cockpit-tools" as const;
+export const ACCOUNT_IMPORT_MAX_BYTES = 256 * 1024;
+// The HTTP request also carries the fixed provider/format envelope. Keep that envelope bounded
+// without making a valid document at the 256 KiB contract boundary fail at the API layer.
+export const ACCOUNT_IMPORT_MAX_REQUEST_BYTES = ACCOUNT_IMPORT_MAX_BYTES + 1024;
+// Shared CLI POST timeout and management-route deadline. Individual provider requests keep
+// shorter timeouts; this bounds the full admitted batch (up to ACCOUNT_IMPORT_MAX_RECORDS).
+export const ACCOUNT_IMPORT_DEADLINE_MS = 600_000;
+export const ACCOUNT_IMPORT_MAX_RECORDS = 25;
+export const ACCOUNT_IMPORT_MAX_EMAIL_LENGTH = 254;
+export const ACCOUNT_IMPORT_MAX_REFRESH_TOKEN_BYTES = 16 * 1024;
+
+export type AccountImportStatus = "imported" | "updated" | "failed" | "unsupported";
+
+export type AccountImportCode =
+  | "imported"
+  | "updated"
+  | "import_cancelled"
+  | "unsupported_provider"
+  | "unsupported_format"
+  | "invalid_document"
+  | "invalid_record"
+  | "credential_rejected"
+  | "identity_mismatch"
+  | "missing_project"
+  | "persist_failed";
+
+export interface AccountImportRecordResult {
+  index: number;
+  status: AccountImportStatus;
+  code: AccountImportCode;
+}
+
+export interface AccountImportResult {
+  totalCount: number;
+  importedCount: number;
+  updatedCount: number;
+  failedCount: number;
+  unsupportedCount: number;
+  results: AccountImportRecordResult[];
+}
+
+export interface AccountImportRequest {
+  provider: string;
+  format: string;
+  document: unknown;
+  signal?: AbortSignal;
+}
+
+/** A secret-free terminal signal for a cancelled import request. */
+export class AccountImportAbortError extends Error {
+  constructor() {
+    super("Account import cancelled");
+    this.name = "AccountImportAbortError";
+  }
+}
+
+export function throwIfAccountImportAborted(signal?: AbortSignal): void {
+  if (signal?.aborted) throw new AccountImportAbortError();
+}
+
+export interface CockpitAccountRecord {
+  email: string;
+  refreshToken: string;
+}
+
+export type ParsedCockpitRecord =
+  | { index: number; record: CockpitAccountRecord }
+  | { index: number; code: "invalid_record" };
+
+export type AccountImportRecordOutcome =
+  | { status: "imported"; code: "imported" }
+  | { status: "updated"; code: "updated" }
+  | {
+    status: "failed";
+    code: "credential_rejected" | "identity_mismatch" | "missing_project" | "persist_failed";
+  };
+
+export interface AccountImportAdapter {
+  readonly provider: typeof ACCOUNT_IMPORT_PROVIDER;
+  readonly format: typeof ACCOUNT_IMPORT_FORMAT;
+  importRecord(record: CockpitAccountRecord, signal?: AbortSignal): Promise<AccountImportRecordOutcome>;
+}
+
+export interface ValidatedAntigravityCredential extends OAuthCredentials {
+  email?: string;
+  projectId?: string;
+}

package/src/oauth/anthropic.ts

@@ -81,10 +81,21 @@ function parseTokenResponse(responseBody: string): AnthropicTokenResponse {
 function credsFrom(data: AnthropicTokenResponse, refreshFallback?: string): OAuthCredentials {
   const accountUuid = data.account?.uuid;
   const email = data.account?.email_address;
+  // Guard against a missing/non-finite/negative expires_in (malformed upstream
+  // response): a NaN expiry would never compare as expired, and a negative
+  // duration would stamp an already-past expiry — both block refresh semantics.
+  const expiresIn =
+    typeof data.expires_in === "number" && Number.isFinite(data.expires_in) && data.expires_in >= 0
+      ? data.expires_in
+      : 3600;
+  // The computed timestamp itself must stay finite: Number.MAX_VALUE passes
+  // Number.isFinite but overflows to Infinity once multiplied by 1000.
+  const computedExpires = Date.now() + expiresIn * 1000 - 5 * 60 * 1000;
+  const expires = Number.isFinite(computedExpires) ? computedExpires : Date.now() + 3600 * 1000 - 5 * 60 * 1000;
   return {
     refresh: data.refresh_token || refreshFallback || "",
     access: data.access_token,
-    expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+    expires,
     accountId: typeof accountUuid === "string" && accountUuid.length > 0 ? accountUuid : undefined,
     email: typeof email === "string" && email.length > 0 ? email : undefined,
   };

package/src/oauth/callback-server.ts

@@ -5,7 +5,7 @@
  * Change vs source: the success/error page is an inline HTML constant. opencodex's GUI polls
  * GET /api/oauth/status, so it does not need OAuth state injected into the callback page.
  *
- * Handles: port allocation (preferred → random fallback), callback server, CSRF state,
+ * Handles: port allocation (preferred → random/manual-only fallback), callback server, CSRF state,
  * manual-input race, 300s timeout. Providers implement generateAuthUrl() + exchangeToken().
  */
 import { isAddrInUse } from "../server/ports";
@@ -131,8 +131,14 @@ export abstract class OAuthCallbackFlow {
       }
       const redirectUri = `http://${this.callbackHostname}:${this.preferredPort}${this.callbackPath}`;
       return { servers, redirectUri };
-    } catch {
+    } catch (error) {
       if (this.redirectUri) {
+        // Fixed OAuth redirect URIs cannot move to a random port. Remote dashboards can
+        // still complete the same state/PKCE flow by pasting the final redirect URL or
+        // authorization code, so do not make a local listener a prerequisite for that path.
+        if (this.ctrl.onManualCodeInput && isAddrInUse(error)) {
+          return { servers: [], redirectUri: this.redirectUri };
+        }
         throw new Error(
           `OAuth callback port ${this.preferredPort} unavailable; cannot fall back to a random port when redirectUri is set`,
         );

package/src/oauth/chatgpt.ts

@@ -49,10 +49,21 @@ export function extractEmail(idToken?: string, accessToken?: string): string | u
 function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
   const idToken = typeof data.id_token === "string" ? data.id_token : undefined;
   const accessToken = data.access_token as string;
+  // ?? only guards null/undefined; NaN or a string expires_in would otherwise
+  // produce a NaN expiry that never compares as expired, and a negative duration
+  // would stamp an already-past expiry — both block refresh semantics.
+  const expiresIn =
+    typeof data.expires_in === "number" && Number.isFinite(data.expires_in) && data.expires_in >= 0
+      ? data.expires_in
+      : 3600;
+  // The computed timestamp itself must stay finite: Number.MAX_VALUE passes
+  // Number.isFinite but overflows to Infinity once multiplied by 1000.
+  const computedExpires = Date.now() + expiresIn * 1000;
+  const expires = Number.isFinite(computedExpires) ? computedExpires : Date.now() + 3600 * 1000;
   return {
     access: accessToken,
     refresh: (data.refresh_token as string) ?? "",
-    expires: Date.now() + ((data.expires_in as number) ?? 3600) * 1000,
+    expires,
     accountId: extractAccountId(idToken, accessToken),
     email: extractEmail(idToken, accessToken),
   };

package/src/oauth/google-antigravity.ts

@@ -20,6 +20,7 @@ const CLIENT_SECRET = process.env.GOOGLE_ANTIGRAVITY_CLIENT_SECRET
   || "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";
 const AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
 const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const USERINFO_ENDPOINT = "https://www.googleapis.com/oauth2/v2/userinfo";
 const PROD_API = "https://cloudcode-pa.googleapis.com";
 const DAILY_API = "https://daily-cloudcode-pa.googleapis.com";
 const API_VERSION = "v1internal";
@@ -228,3 +229,29 @@ export async function refreshAntigravityToken(refreshToken: string, signal?: Abo
   const projectId = await discoverAntigravityProject(creds.access, signal).catch(() => undefined);
   return projectId ? { ...creds, projectId } : creds;
 }
+
+/**
+ * Refresh and derive import identity from Google's pinned userinfo endpoint. Imports may not
+ * borrow the email written in a local file: that would let one valid token overwrite another
+ * account's slot when a refresh response has no id_token.
+ */
+export async function validateAntigravityImportCredential(
+  refreshToken: string,
+  signal?: AbortSignal,
+): Promise<OAuthCredentials> {
+  const credential = await refreshAntigravityToken(refreshToken, signal);
+  const response = await fetch(USERINFO_ENDPOINT, {
+    method: "GET",
+    headers: { Accept: "application/json", Authorization: `Bearer ${credential.access}` },
+    signal: requestSignal(signal),
+  });
+  if (!response.ok) throw new Error(`Antigravity identity request failed: ${response.status}`);
+  const body = (await response.json().catch(() => undefined)) as { email?: unknown; id?: unknown } | undefined;
+  if (typeof body?.email !== "string" || body.email.length === 0) {
+    throw new Error("Antigravity identity response did not include an email");
+  }
+  if (typeof body.id !== "string" || body.id.length === 0) {
+    throw new Error("Antigravity identity response did not include an account id");
+  }
+  return { ...credential, accountId: body.id, email: body.email.toLowerCase() };
+}

package/src/oauth/health.ts

@@ -3,16 +3,11 @@ import { getAnthropicAccountHealthSnapshot } from "./anthropic-routing";
 import { isAccountNeedsReauth } from "../codex/account-runtime-state";
 import { getCodexAccountCredential, listCodexAccountIds } from "../codex/account-store";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
-import { configuredAdminToken } from "../lib/admin-secrets";
 import { readRuntimePort } from "../config";
-import {
-  LOCAL_ATTESTATION_CHALLENGE_HEADER,
-  LOCAL_ATTESTATION_PROOF_HEADER,
-  createLocalAttestationChallenge,
-  verifyLocalAttestationProof,
-} from "../lib/local-management-attestation";
+import { LOCAL_MANAGEMENT_READ_PATHS } from "../lib/local-management-capability";
 import { maskAccountId } from "../lib/privacy";
-import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
+import { findLiveProxy } from "../server/proxy-liveness";
+import { fetchBoundLocalManagementRead } from "../server/local-management-read-client";
 import { loadAuthStore, peekAuthStore, peekOAuthRefreshIntent, readOAuthRefreshIntent } from "./store";
 import type { ProviderAccount } from "./types";
 
@@ -333,53 +328,22 @@ type LiveProxyCodexHealthResult = {
 };
 
 async function fetchCodexHealthFromLiveProxy(
-  fetchImpl: typeof fetch = fetch,
+  fetchImpl: typeof fetch | undefined = undefined,
   findLiveProxyImpl: typeof findLiveProxy = findLiveProxy,
   readRuntimePortImpl: typeof readRuntimePort = readRuntimePort,
 ): Promise<LiveProxyCodexHealthResult> {
   const live = await findLiveProxyImpl();
   if (!live) return { source: "unavailable", entries: null };
-  // This is a management-plane endpoint. A data-plane service token is intentionally not
-  // interchangeable with the admin credential even on loopback.
-  const token = configuredAdminToken();
-  const headers: Record<string, string> = {};
   try {
-    if (token) {
-      // Public /healthz identity is intentionally forgeable enough for liveness, not
-      // strong enough to receive a bearer. Prove the listener knows the per-process
-      // secret stored in the protected runtime record before attaching the admin token.
-      if (live.source !== "runtime" || live.pid === null) {
-        return { source: "management-api-unavailable", entries: null };
-      }
-      const attestedPid = live.pid;
-      const runtime = readRuntimePortImpl(attestedPid);
-      if (!runtime?.attestationSecret || runtime.port !== live.port) {
-        return { source: "management-api-unavailable", entries: null };
-      }
-      const challenge = createLocalAttestationChallenge();
-      const proofResponse = await fetchImpl(
-        `http://${probeHostname(live.hostname)}:${live.port}/healthz`,
-        {
-          headers: { [LOCAL_ATTESTATION_CHALLENGE_HEADER]: challenge },
-          signal: AbortSignal.timeout(4000),
-        },
-      );
-      const proof = proofResponse.headers.get(LOCAL_ATTESTATION_PROOF_HEADER);
-      if (!proofResponse.ok || !verifyLocalAttestationProof(
-        runtime.attestationSecret,
-        challenge,
-        attestedPid,
-        live.port,
-        proof,
-      )) {
-        return { source: "management-api-unavailable", entries: null };
-      }
-      headers.Authorization = `Bearer ${token}`;
-    }
-    const res = await fetchImpl(
-      `http://${probeHostname(live.hostname)}:${live.port}/api/codex-auth/accounts`,
-      { headers, signal: AbortSignal.timeout(4000) },
+    const read = await fetchBoundLocalManagementRead(
+      live,
+      LOCAL_MANAGEMENT_READ_PATHS.codexAccounts,
+      { fetchImpl, readRuntime: readRuntimePortImpl, timeoutMs: 4_000 },
     );
+    if (read.kind === "unavailable") {
+      return { source: "management-api-unavailable", entries: null };
+    }
+    const res = read.response;
     if (res.status === 401 || res.status === 403) {
       return { source: "management-auth-failed", entries: null };
     }